ccgx-workflow 2.0.0 → 2.1.1

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import cac from 'cac';
 import ansis from 'ansis';
-import { d as diagnoseMcpConfig, i as isWindows, r as readClaudeCodeConfig, f as fixWindowsMcpConfig, w as writeClaudeCodeConfig, a as readCcgConfig, b as initI18n, c as i18n, s as showMainMenu, e as init, g as configMcp, v as version } from './shared/ccgx-workflow.Bd3sZyxW.mjs';
+import { d as diagnoseMcpConfig, i as isWindows, r as readClaudeCodeConfig, f as fixWindowsMcpConfig, w as writeClaudeCodeConfig, a as readCcgConfig, b as initI18n, c as i18n, s as showMainMenu, e as init, g as configMcp, v as version } from './shared/ccgx-workflow.BIcRT31-.mjs';
 import { execSync } from 'node:child_process';
 import 'inquirer';
 import 'ora';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { h as collectSkills, j as resolvePluginBashCommand } from './shared/ccgx-workflow.Bd3sZyxW.mjs';
-export { k as changeLanguage, G as checkForUpdates, I as collectInvocableSkills, H as compareVersions, m as createDefaultConfig, n as createDefaultRouting, J as generateCommandContent, o as getCcgDir, p as getConfigPath, E as getCurrentVersion, F as getLatestVersion, t as getWorkflowById, q as getWorkflowConfigs, c as i18n, e as init, b as initI18n, y as installAceTool, z as installAceToolRs, K as installSkillCommands, x as installWorkflows, C as migrateToV1_4_0, D as needsMigration, L as parseFrontmatter, a as readCcgConfig, s as showMainMenu, B as uninstallAceTool, A as uninstallWorkflows, u as update, l as writeCcgConfig } from './shared/ccgx-workflow.Bd3sZyxW.mjs';
+import { h as collectSkills, j as resolvePluginBashCommand } from './shared/ccgx-workflow.BIcRT31-.mjs';
+export { k as changeLanguage, G as checkForUpdates, I as collectInvocableSkills, H as compareVersions, m as createDefaultConfig, n as createDefaultRouting, J as generateCommandContent, o as getCcgDir, p as getConfigPath, E as getCurrentVersion, F as getLatestVersion, t as getWorkflowById, q as getWorkflowConfigs, c as i18n, e as init, b as initI18n, y as installAceTool, z as installAceToolRs, K as installSkillCommands, x as installWorkflows, C as migrateToV1_4_0, D as needsMigration, L as parseFrontmatter, a as readCcgConfig, s as showMainMenu, B as uninstallAceTool, A as uninstallWorkflows, u as update, l as writeCcgConfig } from './shared/ccgx-workflow.BIcRT31-.mjs';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, statSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';

package/dist/shared/{ccgx-workflow.Bd3sZyxW.mjs → ccgx-workflow.BIcRT31-.mjs}

@@ -13,7 +13,7 @@ import { join as join$2 } from 'node:path/posix';
 import { join as join$1 } from 'node:path';
 import i18next from 'i18next';
 
-const version = "2.0.0";
+const version = "2.1.1";
 
 function cmd(id, order, category, name, nameEn, description, descriptionEn, cmdOverride) {
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccgx-workflow",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "Multi-model orchestration for Claude Code. Codex + Gemini parallel collaboration with fresh-context subagent protocols, OS-level process isolation, and Plan-Critic-Verify quality tiers. Successor to ccg-workflow.",
   "type": "module",
   "packageManager": "pnpm@10.17.1",

package/templates/commands/review.md

@@ -66,20 +66,20 @@ argument-hint: "[代码或描述] [--adversarial] [--fix [--all] [--auto]] [--ro
 Step 1. 用 Write 工具把【小任务描述】写到 tmpfile
    ⚠️ 内容必须是任务说明（≤ 2KB），不要塞 git diff / 文件内容
    Write({
-     file_path: "/tmp/ccg-review-codex-$JOB.txt",
+     file_path: ".context/tmp/ccg-review-codex-$JOB.txt",
      content: <下方"任务描述模板">  
    })
    Write({ 同上，gemini 版本 })
 
 Step 2. 用 Bash 调 helper（占位符已渲染）：
    Bash({
-     command: `{{CODEX_BASH_TASK}} --prompt-file /tmp/ccg-review-codex-$JOB.txt`,
+     command: `{{CODEX_BASH_TASK}} --prompt-file .context/tmp/ccg-review-codex-$JOB.txt`,
      description: "Review: backend (codex direct)",
      run_in_background: true,
      timeout: 3600000
    })
    Bash({
-     command: `{{GEMINI_BASH_TASK}} --prompt-file /tmp/ccg-review-gemini-$JOB.txt`,
+     command: `{{GEMINI_BASH_TASK}} --prompt-file .context/tmp/ccg-review-gemini-$JOB.txt`,
      description: "Review: frontend (gemini direct)",
      run_in_background: true,
      timeout: 3600000
@@ -148,14 +148,14 @@ CLI 空答 / auth 过期时 wrapper 受 instruction-tuning 驱动**自答 fabric
 
 ```
 Bash({
-  command: "cat /tmp/ccg-review-codex-$JOB.txt | ~/.claude/bin/codeagent-wrapper {{LITE_MODE_FLAG}}--progress --backend codex - \"{{WORKDIR}}\"",
+  command: "cat .context/tmp/ccg-review-codex-$JOB.txt | ~/.claude/bin/codeagent-wrapper {{LITE_MODE_FLAG}}--progress --backend codex - \"{{WORKDIR}}\"",
   run_in_background: true,
   timeout: 3600000,
   description: "Review: backend (wrapper fallback)"
 })
 ```
 
-`/tmp/ccg-review-codex-$JOB.txt` 同 通道 A 的"任务描述模板"——不变。
+`.context/tmp/ccg-review-codex-$JOB.txt` 同 通道 A 的"任务描述模板"——不变。
 
 > ⚠️ 通道 B `codeagent-wrapper` 已标 **deprecated**，仅 plugin 未装时使用。
 
@@ -227,11 +227,11 @@ Bash({
 
 ```
 Step 1. 用 Write 把任务描述写入 tmpfile（同样不塞 diff，让 codex 自己读）:
-   Write({ file_path: "/tmp/ccg-review-adv-$JOB.txt", content: <下方任务描述> })
+   Write({ file_path: ".context/tmp/ccg-review-adv-$JOB.txt", content: <下方任务描述> })
 
 Step 2. 调 helper:
    Bash({
-     command: `{{CODEX_BASH_TASK}} --prompt-file /tmp/ccg-review-adv-$JOB.txt`,
+     command: `{{CODEX_BASH_TASK}} --prompt-file .context/tmp/ccg-review-adv-$JOB.txt`,
      description: "Adversarial review (codex direct)",
      run_in_background: true,
      timeout: 3600000

package/templates/scripts/ccgx-call-plugin.mjs

@@ -44,7 +44,7 @@
 //    --prompt-file <path>    Required. Path to file containing prompt body.
 //    --json                  Pass --json to companion (default: true).
 //    --no-json               Disable --json (text output).
-//    --timeout-ms <N>        Kill companion after N ms (default: 600000).
+//    --timeout-ms <N>        Kill companion if total wall-time exceeds N ms (default: 7200000, 2h; pass 0 to disable).
 //    --max-budget-usd <N>    Forwarded to companion (default: 50).
 //
 //  Cross-cutting:
@@ -55,9 +55,9 @@
 // =============================================================================
 
 import { spawn } from 'node:child_process'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, realpathSync, unlinkSync } from 'node:fs'
 import { homedir, platform } from 'node:os'
-import { join } from 'node:path'
+import { basename, join, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 // ---------------------------------------------------------------------------
@@ -73,6 +73,27 @@ const VENDOR_KEYS = {
   gemini: ['gemini@gemini-ccgx', 'gemini@google-gemini'],
 }
 
+// ---------------------------------------------------------------------------
+// Vendor → preferred entry script (relative to <installPath>/scripts/).
+//
+// gemini: prefer `gemini-batch.mjs` (CCG-only, bypasses ACP broker entirely
+// — direct gemini-cli batch mode via stdin + --output-format json). Falls
+// back to the legacy `gemini-companion.mjs task` (ACP path) only if the
+// batch entry isn't shipped.
+//
+// Why bypass ACP: gemini-cli 0.40+'s session/new RPC runs MCP setup + auth
+// refresh + chat startup synchronously inside the agent. On Windows the
+// gemini-plugin-cc ACP broker + named-pipe transport reliably hangs trivial
+// trips for 5+ minutes even when the direct CLI returns in 10-30s. Batch
+// mode side-steps the entire transport stack (no broker, no detached
+// process, no orphan MCP children).
+// ---------------------------------------------------------------------------
+
+const VENDOR_ENTRY_SCRIPTS = {
+  codex: ['codex-companion.mjs'],
+  gemini: ['gemini-batch.mjs', 'gemini-companion.mjs'],
+}
+
 // ---------------------------------------------------------------------------
 // Argument parsing — minimal, KISS, no external CLI lib.
 // ---------------------------------------------------------------------------
@@ -82,8 +103,25 @@ function parseArgs(argv) {
     vendor: null,
     promptFile: null,
     json: true,
-    timeoutMs: 600000,
+    // 2.1.1: wall-time bumped 600s → 7200s (2h). Real codex audits /
+    // multi-file reviews / planning tasks routinely run 5-30 min; the old
+    // 600s default was SIGTERM-ing healthy tasks mid-thought. 2h is a
+    // generous safety ceiling — pass 0 to disable entirely.
+    timeoutMs: 7200000,
+    // 2.1.1: NEW idle timeout. Wall-time alone is the wrong signal — a
+    // healthy long-running audit produces continuous stdout/stderr (tool
+    // calls, progress lines). A truly hung companion produces nothing.
+    // We track lastActivityAt on every stdout/stderr chunk and SIGTERM if
+    // silent for idleTimeoutMs (default 600s = 10min). Pass 0 to disable.
+    idleTimeoutMs: 600000,
     maxBudgetUsd: 50,
+    // 1.0.5 regression fix: pre-1.0.5 callers always passed --write directly
+    // to codex-companion. Default true preserves BC; --no-write opt-out for
+    // read-only review flows.
+    write: true,
+    model: null,
+    effort: null,
+    cwd: null,
   }
 
   const positional = []
@@ -99,7 +137,13 @@ function parseArgs(argv) {
       case '--json':           opts.json = true; break
       case '--no-json':        opts.json = false; break
       case '--timeout-ms':     opts.timeoutMs = Number.parseInt(next(), 10); break
+      case '--idle-timeout-ms': opts.idleTimeoutMs = Number.parseInt(next(), 10); break
       case '--max-budget-usd': opts.maxBudgetUsd = Number.parseFloat(next()); break
+      case '--write':          opts.write = true; break
+      case '--no-write':       opts.write = false; break
+      case '--model':          opts.model = next(); break
+      case '--effort':         opts.effort = next(); break
+      case '--cwd':            opts.cwd = next(); break
       case '--help':
       case '-h':
         printHelp()
@@ -133,8 +177,14 @@ Required:
 Optional:
   --json                  Pass --json to companion (default: true)
   --no-json               Disable --json (text output)
-  --timeout-ms <N>        Kill companion after N ms (default: 600000)
+  --timeout-ms <N>        Kill companion if total wall-time exceeds N ms (default: 7200000, 2h; pass 0 to disable)
+  --idle-timeout-ms <N>   Kill companion if no stdout/stderr output for N ms (default: 600000, 10min; pass 0 to disable). Idle detection is the right signal for "hung" — healthy long-running audits keep producing tool-call progress.
   --max-budget-usd <N>    Per-call cost cap (default: 50)
+  --write                 Enable workspace-write sandbox (default: true; codex needs this to spawn read commands too under default approval policy)
+  --no-write              Force read-only sandbox (companion approval-policy will decline most commands)
+  --model <name>          Override model (codex only; gemini ignores)
+  --effort <level>        Reasoning effort: none|minimal|low|medium|high|xhigh (codex only)
+  --cwd <path>            Override working directory for the companion call. codex sandbox is cwd-bound; set this when auditing a repo other than the caller's cwd.
 
 Outputs JSON to stdout: {status, vendor, version, durationMs, exitCode, stdout, stderr, error?}
 `)
@@ -180,9 +230,19 @@ function discoverCompanion(vendor, homeDir = homedir()) {
     return { error: `plugin ${matchedKey} has no installPath in installed_plugins.json` }
   }
 
-  const companionPath = join(installPath, 'scripts', `${vendor}-companion.mjs`)
-  if (!existsSync(companionPath)) {
-    return { error: `companion script missing: ${companionPath}` }
+  // Walk the preferred entry-script list. First existing file wins.
+  // BC: vendors with only the legacy companion still resolve correctly.
+  const entryCandidates = VENDOR_ENTRY_SCRIPTS[vendor] ?? [`${vendor}-companion.mjs`]
+  let companionPath = null
+  for (const name of entryCandidates) {
+    const candidate = join(installPath, 'scripts', name)
+    if (existsSync(candidate)) {
+      companionPath = candidate
+      break
+    }
+  }
+  if (!companionPath) {
+    return { error: `no entry script found for ${vendor} (tried: ${entryCandidates.join(', ')}) in ${join(installPath, 'scripts')}` }
   }
 
   return {
@@ -237,6 +297,35 @@ async function main(argv) {
     process.exit(66) // EX_NOINPUT
   }
 
+  // 2.1.1: auto-delete the prompt file after a successful read iff the
+  // PHYSICAL path sits inside the caller's `<cwd>/.context/tmp/` AND the
+  // filename starts with `ccg-`. This is the workflow-managed throwaway-
+  // prompt directory (see templates/commands/review.md — Step 1 writes
+  // prompts here).
+  //
+  // CRITICAL — codex audit 2026-05-12 raised: lexical `resolve()` is
+  // insufficient. If `.context` or `.context/tmp` is a symlink/junction
+  // pointing outside the workspace, OR the caller passes a path whose
+  // lexical form is `<cwd>/.context/tmp/ccg-x.txt` but its physical
+  // target is `/etc/passwd` (or worse, `C:\Windows\System32\...`), the
+  // lexical-only check would still authorize the unlink. realpathSync
+  // canonicalizes ALL symlinks/junctions/`..` segments before the
+  // whitelist compare — both for the candidate file AND the safeRoot.
+  // Two ANDed gates: physical prefix + filename prefix.
+  try {
+    const resolvedFile = realpathSync(opts.promptFile)
+    const safeRoot = realpathSync(resolve(process.cwd(), '.context', 'tmp')) + sep
+    if (resolvedFile.startsWith(safeRoot) && basename(resolvedFile).startsWith('ccg-')) {
+      unlinkSync(resolvedFile)
+    }
+  }
+  catch {
+    // Best-effort. ENOENT (.context/tmp absent, file already gone, etc.)
+    // is the dominant non-error case here; we deliberately don't surface
+    // it. Real failures (permission etc.) will leave a file behind that
+    // .gitignore catches and the user's next run overwrites.
+  }
+
   // Discover companion via SSoT (no glob, no head -1)
   const disc = discoverCompanion(opts.vendor)
   if (disc.error) {
@@ -252,6 +341,15 @@ async function main(argv) {
     promptBody,
   ]
   if (opts.json) companionArgs.push('--json')
+  // codex-companion flag pass-through (1.0.5 regression fix). gemini-companion
+  // ignores unknown flags safely; both vendors accept this surface.
+  if (opts.write) companionArgs.push('--write')
+  if (opts.model) companionArgs.push('--model', opts.model)
+  if (opts.effort) companionArgs.push('--effort', opts.effort)
+  // --cwd pass-through: codex sandbox is cwd-bound. For cross-repo audits
+  // the caller must set this to the repo being audited (codex-companion
+  // does not expose --add-dir; multi-workspace requires deeper changes).
+  if (opts.cwd) companionArgs.push('--cwd', opts.cwd)
 
   const startedAt = Date.now()
 
@@ -270,24 +368,53 @@ async function main(argv) {
 
   let stdoutBuf = ''
   let stderrBuf = ''
-  child.stdout.on('data', (chunk) => { stdoutBuf += chunk.toString('utf-8') })
-  child.stderr.on('data', (chunk) => { stderrBuf += chunk.toString('utf-8') })
+  let lastActivityAt = Date.now()
+  child.stdout.on('data', (chunk) => {
+    stdoutBuf += chunk.toString('utf-8')
+    lastActivityAt = Date.now()
+  })
+  child.stderr.on('data', (chunk) => {
+    stderrBuf += chunk.toString('utf-8')
+    lastActivityAt = Date.now()
+  })
 
-  // Timeout: kill child if exceeds opts.timeoutMs
+  // 2.1.1: two-layer timeout. wall-time is the safety ceiling; idle is the
+  // primary "stuck" detector — a healthy long task keeps producing tool-call
+  // / progress chunks, a truly hung companion produces nothing. SIGTERM is
+  // best-effort on Windows where the kernel doesn't propagate to the
+  // grandchild tree; companion processes on this code path are expected to
+  // do their own subtree cleanup (taskkill /T) when they receive SIGTERM.
   let timedOut = false
-  const timer = setTimeout(() => {
+  let timeoutReason = null
+  const killChild = (reason) => {
     timedOut = true
+    timeoutReason = reason
     try { child.kill('SIGTERM') } catch { /* ignore */ }
     setTimeout(() => {
       try { child.kill('SIGKILL') } catch { /* ignore */ }
     }, 5000).unref?.()
-  }, opts.timeoutMs)
+  }
+  const wallTimer = opts.timeoutMs > 0
+    ? setTimeout(() => killChild(`wall-time ${opts.timeoutMs}ms`), opts.timeoutMs)
+    : null
+  // Check idle every 30s. A 30s sampling granularity adds at most 30s slop
+  // to the configured idle threshold, which is negligible at 600s default.
+  const idleChecker = opts.idleTimeoutMs > 0
+    ? setInterval(() => {
+        const silent = Date.now() - lastActivityAt
+        if (silent >= opts.idleTimeoutMs) {
+          killChild(`idle ${silent}ms exceeds ${opts.idleTimeoutMs}ms`)
+        }
+      }, 30000)
+    : null
+  if (idleChecker?.unref) idleChecker.unref()
 
   const exit = await new Promise((resolve) => {
     child.once('exit', (code, signal) => resolve({ code, signal }))
     child.once('error', (err) => resolve({ code: 70, signal: null, errorMsg: err.message }))
   })
-  clearTimeout(timer)
+  if (wallTimer) clearTimeout(wallTimer)
+  if (idleChecker) clearInterval(idleChecker)
 
   const durationMs = Date.now() - startedAt
   const status = (!timedOut && exit.code === 0) ? 'ok' : 'error'
@@ -300,7 +427,7 @@ async function main(argv) {
     stdout: stdoutBuf,
     stderr: stderrBuf,
   }
-  if (timedOut) result.error = `timeout after ${opts.timeoutMs}ms`
+  if (timedOut) result.error = `companion killed: ${timeoutReason}`
   else if (exit.errorMsg) result.error = `spawn error: ${exit.errorMsg}`
   else if (exit.code !== 0) result.error = `companion exited with code ${exit.code}`